
BUREAUOF 
DIGITAL FORENSICS 


CUSTODIAN (Last, First) 


IMAGE NAME 


PRIMARY STORAGE S/N 


BACKUP STORAGE S/N 



DIGITAL EVIDENCE WORKSHEET 


Date/Time 

Project Code 

Project Name 

Examiner Name 

Location (Site Name, Address, Room) 

Media Status (Check all that apply) 

□ Removed from system (Hard Drive # of ) □ Remained in system or enclosure during imaging 

□ Hard drive only (not connected to a system) □ Live system acquisition □ Network acquisition 


MEDIA DESCRIPTION MEDIA PHOTOGRAPHED? □ Yes □ No 


Manufacturer 


□ Not Visible 

Model 

□ Not Visible 

OEM Capacity (MB/GB/TB) 

Serial Number 


□ Not Visible 

USB Serial Number (iSerial Number) 

Interface 

(Check all that apply) 

□ IDE □ SATA □ SCSI □ USB □ FireWire □ ZIF 

□ Primary □ Secondary □ Master □ Slave □ CS □ SCSI ID #: 

□ Other (See Notes) 

Removable Media 

□ ThumbDrive 

□ External HD 

□ Compact Flash □ Memory Stick (MS) 

□ Micro Drive □ SmartMedia (SMC) 

□ Secure Digital (SD) 

□ xD Card 

□ Other (See Notes) 

Optical Media 

□ CD-R 

□ Other (See Notes) 

□ CD-RW 

□ DVD+/-R 

□ DVD-RW 

□ Blu-Ray 


IMAGING INFORMATION 


Hardware Write-Block 

□ Tableau □ Acquisition Unit 

□ ImageMaster 

□ Other (See Notes) 


Imaging Tool & Format 

1 1 EnCase (□ Windows □ Linen) 

□ WinFE 

□ MacQuisition 

□ F-Response 

(Check all that apply) 

□ FTK Imager (□ Encase □ dd) 

□ dd/dcfldd 

□ Helix 

□ Other (See Notes) 


COMPUTER DESCRIPTION SYSTEM PHOTOGRAPHED? □ Yes □ No 


Make Model 

□ Generic/None □ Generic/None 

Serial Number 

□ None 

Case Type □ Desktop □ 

□ Mini Tower \Z 

Laptop □ All-In-One □ Rack Mount 

MidTower □ Full Tower □ Other (See Notes) 

CPU (GHz) 

Memory 

Date Seized 

□ Unknown 

Seized By 

□ Unknown 

System 

Status 

□ On □ Off 

□ Unknown □ Other (s 

□ Suspended 

iee Notes) 

Boot Sequence 

Changes Made to BIOS 

Shutdown 

Method 

□ Unknown □ Hard □ Soft □ Left Running 

□ Date/Time of Shutdown: 

System Date 

System Time 

Local Date Local Time (Include Time Zone) 


NOTES 


PD FORM 100 


v 1.0 


































